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Abstract — We determine the secrecy capacity of the compound 
channel with quantum wiretapper and channel state information 
at the transmitter. Moreover, we derive a lower bound on the 
secrecy capacity of this channel without channel state information 
and determine the secrecy capacity of the compound classical- 
quantum wiretap channel with channel state information at 
the transmitter. We use this result to derive a new proof for 
a lower bound on the entanglement generating capacity of 
compound quantum channel. We also derive a new proof for the 
entanglement generating capacity of compound quantum channel 
with channel state information at the encoder. 

Index Terms — Compound channel; Wiretap channels; Quan- 
tum channels; Entanglement generation 



I. Introduction 

Our goal is to analyze information transmission over a set 
of indexed channels, which is called a compound channel. The 
indices are referred as the channel states. Only one channel 
of this set is actually used for the information transmission, 
but the users cannot control which channel of the set will be 
used. The capacity of the compound channel was determined 
in Igl. A compound channel with an eavesdropper is called a 
compound wiretap channel. It is defined as a family of pairs 
of channels {(M^t,V() : t = 1, • • • ,T} with common input 
alphabet and possibly different output alphabets, connecting a 
sender with two receivers, a legal and a wiretapper, where t 
stands for the state of the channel pair {Wt,Vt). The legitimate 
receiver accesses the output of the first channel Wt in the pair 
(Wt, Vt), and the wiretapper observes the output of the second 
part Vt in the pair {Wt, Vt), respectively, when a state t governs 
the channel. A code for the channel conveys information to 
the legal receiver such that the wiretapper's knowledge of the 
transmitted information can be keep sufficiently small. This is 
a generalization of Wyner's wiretap channel [29] to the case 
of multiple channel states. In l29l the author required that the 
wiretapper cannot detect the message, using a weak security 
criterion (cf. Remark [T). 

We deal with two communication scenarios. In the first one, 
only the sender is informed about the index t, or in other 
words, he has CSI, where CSI is the abbreviation for "channel 
state information". In the second one, both the sender and the 
receiver does not have any information about that index at all. 

The compound wiretap channels were introduced in fTSI. 
A lower bound of the secrecy capacity under the condition 



that the sender does not have any knowledge about the CSI 
was obtained. In fTSl the authors required that the receiver's 
average error goes to zero and the wiretapper can not detect the 
message, using the same security criterion as ||291 . The result 
of II 1 81 was improved in |8| by using a stronger condition 
for the limit of legitimate receiver's error, i.e., the maximal 
error should go to zero, as well as a stronger condition for the 
security criterion (cf. Remark [T). Furthermore, the secrecy 
capacity for the case when the sender has knowledge about 
the CSI was determined. 

In this paper we analyze two variants of the compound 
wiretap channel where quantum channels are used. A quantum 
channel can transmit both classical and quantum information. 
We consider the capacity of quantum channels to carry classi- 
cal information. This is equivalently to consider the capacity 
of classical-quantum channels, where the classical-quantum 
channels are quantum channels whose sender's inputs are 
classical variables. In general there are two ways to represent 
a quantum channel with linear algebraic tools (cf. e.g. Section 
IVIII l. either as a sum of several transformations, or as a single 
unitary transformation which explicitly includes the unob- 
served environment. We use the latter one for our result in the 
entanglement generating capacity. These two representations 
can both be used to determine the entanglement generating 
capacity for quantum channels, but it is unknown if this holds 
for the entanglement generating capacity of compound quan- 
tum channels. The classical capacity of quantum channels has 
been determined by Holevo in |15|. The first variant is called 
the classical compound channel with quantum wiretapper. In 
this channel model we assume that the wiretap channels are 
quantum channels, while the legal transmission channels are 
classical channels. The second variant is called the compound 
classical-quantum wiretap channel. In this channel model, we 
assume that both families of channels are quantum channels, 
while the sender transmits classical information. Our results 
are summarized as follows. Under the condition that the sender 
has knowledge about the CSI, the secrecy capacity for these 
two channel models are derived. Additionally, when the sender 
does not have any knowledge about the CSI, we determine the 
secrecy capacity of the compound classical-quantum wiretap 
channel, and give a lower bound for the secrecy capacity of 
the classical compound channel with quantum wiretapper. 



1 



As an application of the above results, we turn to the 
question, what is the maximal amount of entanglement, that 
we can generate or transmit over a given compound quantum 
channel. For the sender and the receiver, the objective is to 
share a nearly maximally entangled state on a 2"-" X 2"-" 
dimensional Hilbert space by using a large number n instances 
of the compound quantum channel. Such quantum communi- 
cation tasks are needed, for example, to support computation 
in quantum circuits or to provide the best possible supply of 
pure entanglement in a noisy environment. The entanglement 
generating capacity of quantum channel has been determined 
by in [131 and [4J. The entanglement generating capacities 
of compound quantum channel with and without CSI have 
been determined in (6\ and fT^. In our paper we derive 
a lower bound on the entanglement generating capacity of 
compound quantum channel by using an alternative technique 
to the method in |6| and |7| (cf. Section I VIII ). Furthermore, 
we derive the entanglement generating capacity of compound 
quantum channel with CSI at the encoder using the alternative 
technique. 

The main definitions are given in Section |II] 

In Section |III] we present some known results for classical 
compound wiretap channel which are used for the proof of the 
results in Section HV] 

In Section |IV] we discuss the classical compound channel 
with quantum wiretapper For the case when the sender has the 
full knowledge about the CSI, we derive the secrecy capacity. 
For the case when the sender does not know the CSI, we give 
a lower bound for the secrecy capacity. In this channel model 
the wiretapper uses classical-quantum channels. 

In Section |V] we derive the secrecy capacity of the com- 
pound classical-quantum wiretap channel with CSI. In this 
model both the receiver and the wiretapper use classical 
quantum channels and the set of the channel states may be 
finite or infinite. 

In Section [Vl] we use the results of Section [V] to derive 
a lower bound on the entanglement generating capacity for 
compound quantum channel. The entanglement generating 
capacity of compound quantum channel with CSI at the 
encoder is also derived. 

In Section IVIII we discuss the two ways to represent a 
quantum channel with linear algebraic tools. 

II. Preliminaries 

For finite sets A and B we define a (discrete) classical 
channel U: A ^ P{B), A 3 x \J{x) & P{B) to be a 
system characterized by a probability transition matrix U(-|-). 
Here P{B) stands for the sets of probability distributions on 
B. For X £ A, y E B, \J{y\x) expresses the probability of 
the output symbol y when we send the symbol x through 
the channel. The channel is said to be memoryless if the 
probability distribution of the output depends only on the 
input at that time and is conditionally independent of previous 
channel inputs and outputs. 

Let U" stands for the n-th memoryless extension of the 
stochastic matrix U, i.e., for a;" = (a;i,--- ,Xn) & A^ and 

EH). 



For a discrete random variable X on A, and a discrete 
random variable Y on B, we denote the Shannon entropy 
by H{X) and the mutual information between X and Y by 
I{X-Y) (cf. [27]). 

For a probability distribution Q on A, a conditional stochas- 
tic matrix A, and a positive constant 6, denote the set of 
typical sequences by Tq g and the set of conditionally typical 
sequences by Tjl^si^^) (here we use the strong condition) (cf. 

EJI). 

For finite-dimensional complex Hilbert spaces G and G" 
a quantum channel U: S{G) S{G'), S{G) 3 p ^ 
U{p) e S{G') is represented by a completely positive trace 
preserving map, which accepts input quantum states in S{G) 
and produces output quantum states in S{G'). Here S{G) and 
S{G') stand for and the space of density operators on G", 
respectively. 

If the sender wishes to transmit a classical message m E M 
to the receiver using a quantum channel, his encoding proce- 
dure will include a classical-to-quantum encoder M S{G) 
to prepare a quantum message state p G S{G) suitably as input 
for the channel. If the sender's encoding is restricted to trans- 
mitting an indexed finite set of orthogonal quantum states {p^ : 
X E A} C S{G), then we can consider the choice of the signal 
quantum states p^ to be a component of the channel. Thus, 
we obtain a channel with classical inputs x E A and quantum 
outputs: ax ■— U{px), which we call a classical-quantum 
channel. This is a map \J: A ^ S{G'), X3 x^ \J{x) E S{G') 
which is represented by the set of possible output quantum 
states {<Tx = U(a;) :— U{px) : x E A] El S{G'), meaning that 
each classical input of a; e ^4 leads to a distinct quantum 
output ax eS{G'). 

Associate to U and U are the channel maps on n-block t/"*": 
5(G®") ^ 5(G'^"), and U®": A" 5(G'®"), such that for 
=pi0...,^p„ E 5(G®")anda;" = (xi,--- ,a;„) E A", 
= U{pi) U{pn), and uf "(x") = U(a;i) (g) 

• • • U(x„), respectively. 

For a quantum state p E S{G) denote the von Neumann 
entropy of p by 

S{p) = -tTip\0gp) . 

Let *p and Q be quantum systems, denote the Hilbert Space 
of *p and £} by G'^ and G^, respectively. Let (f>he a quantum 
state in 5(G'P^), denote p tr0((/)) E 5(G'P), and a := 
trfp(0) E S{G^). The conditional quantum entropy of a given 
p is denote by 

Sia I p) 5(0) - Sip) . 

For quantum states p and a E S{G) denote the fidelity of p 
and a by 

F{p,a) ■.= \\VpM\1 , 

where || • ||i is the Zi-norm for matrices. 

For a quantum state p E S{G) and a quantum channel U: 
S{G) — > S{G'), the coherent information is defined as 

Ic{p,U) :=5(t/(p))-5((zdG'®C/)(|^)(Vl)) , 
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where (-01 is an arbitrary purification of p in S{G)®S{G'). 
Let $ {px : x £ A} be a set of quantum states labeled 
by elements of X. For a probability distribution Q on A, the 
Holevo X quantity is defined as 

xiQ; $) 5 [ ^ Q{x)px J - ^ Q{x)S [p,] . 

\x£A / xeA 



For p E S{H) and a > there exists an orthogonal 
subspace projector IIp.Q commuting with p®" and satisfying 

d 



(1) 
(2) 



np,„ • p®" • np,„ < 2-"^(p)+^''"v^np,„ , (3) 

where d :— dimiJ, and ii' is a positive constant. 
For P e P{A), a > and x^ £ Tp there exists an 
orthogonal subspace projector \Li^a{x^) commuting with vf"" 
and satisfying 



tr(v»"(a;")nv,a(x")) > 1 



ad 



(4) 



Ana^ 

tr (nv,a(a;")) < 2"'5(v|^)+^'^'i"v^ , (5) 



nv.a(a;")-V«"(a:")-nv,a(x") 



tr (V«"(x") . np,,„^) > 1 



ad 
Ana^ 



(6) 



(7) 



where a :— and A' is a positive constant (cf. fSl\ ). 

We denote the identity operator on a space G by ida- 

Let A, B, and C be finite sets. Let H, H' , and iJ" be 
complex Hilbert spaces. Let *p and Q be quantum systems, 
denote the Hilbert Space of <p and Q by iJ'P and i/*^, 
respectively. Let 9 := {1, • • • , T} be a finite set. For every 
t e 6* let 

Wf be a classical channel A — > P{B); 

Vt be a classical channel A P{C)', 

Vt be a classical-quantum channel A — ^ S{H); 

Wt be a quantum channel S{H') ->■ S{H")\ 

Vt be a quantum channel S{H') — S{H); 

Nt be a quantum channel 

We call the set of the classical channel pairs {\Nt,\/t)t£0 
a (classical) compound wiretap channel. When the channel 
state is t, and the sender inputs a sequence e A" into 
the channel, the receiver receives the output e with 
probability W"(j/"|a;"), while the wiretapper receives the 
output z" e Z" with probability V^{z"\x"). 

We call the set of the classical channel/classical-quantum 
channel pairs (W(,Vt)tge a compound channel with quan- 
tum wiretapper. When the channel state is t and the sender 



inputs a sequence a;" £ A" into the channel, the receiver re- 
ceives the output J/" £ B" with probability W" (i/"|a;"), while 
the wiretapper receives an output quantum state uf "(x") £ 

We call the set of the quantum channel pairs {Wt,Vt)t£e 
a quantum compound wiretap channel. When the channel 
state is t and the sender inputs a quantum state p^" £ 
S{H'^"') into the channel, the receiver receives an output 
quantum state T^f "(p^") £ while the wiretapper 

receives an output quantum state Vf''^{p^") £ 

We call the set of the quantum channel {Nt)tee a quan- 
tum compound channel. When the channel state is t and 
the sender inputs a quantum state p'^" £ into 
the channel, the receiver receives an output quantum state 

We distinguish two different scenarios according to the 
sender's knowledge of the channel state: 

• the sender has the CSI, i.e. he knows which t the channel 
state actually is, 

• the sender does not have any CSI. 

In both cases, we assume that the receiver does not have any 
CSI, but the wiretapper always has the full knowledge of the 
CSI. Of course we also have the case where both the sender 
and the receiver has the CSI, but this case is equivalent to the 
case when we only have one pair of channels (Wt, Vt), instead 
of a family of pairs of channels {(W^t, Vt) : t = 1, - ■ ■ , T}. 

An {n, Jn) code for the compound wiretap chan- 
nel (Wt,Vt)tg0 consists of a stochastic encoder E : 
{1, • • • , Jn} — > specified by a matrix of conditional 

probabilities E{-\-), and a collection of mutually disjoint sets 
{Dj C B" : j e {1, • • • , Jn}} (decoding sets). 

If the sender has the CSI, then we may use the following 
strategy. For every t £ 9 the sender and the receiver build an 
{n, Jn) code {Et, {Dj : j — 1, - ■ ■ , J„}) such that all codes 
in ^{Et,{Dj : j = 1, • • • , Jn}) : t £ 9^ share the same 
decoding sets {Dj : j — 1, ■ ■ ■ , Jn}, which do not depend on 
t, to transform the message, instead of use a single code for 
all t. 

A non-negative number R is an achievable secrecy rate for 
the compound wiretap channel (Wf , Vf ) having CSI at the en- 
coder, if for every positive e, S, every t £ 6, and a sufficiently 
large n there is an (n, J„) code {Et, {Dj : j = 1, - ■ ■ , Jn}), 
such that - log Jn > R ^ S, and 



max max 

tee je{i,-:JA 



Et{x''\])W,\D'j\x^) < e , (8) 



max/(X„ 

tee 



(9) 



where Xuni is a random variable uniformly distributed on 
{1, • • • , Jn}, and are the resulting random variables at the 
output of wiretap channels V". Here for a set S, S'^ denotes 
its complement. 

Remark 1: A weaker and widely used security crite- 
rion, e.g. in ifTSl (also cf. [29] for wiretap channel's 
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security criterion), is obtained if we replace (|9) with 
maxtgg jJ{X^ni\K^t) < e ■ In this paper we will follow p8l 
and use @. 

A non-negative number R is an achievable secrecy rate for 
the compound wiretap channel {\Nt,\/t) having no CSI at the 
encoder, if for every positive e, 5 and a sufficiently large n 
there is an {n, Jn) code [E, {Dj : j = 1, - ■ ■ , J„}) such that 
i log J„ > i? - S, and 

max^^max^^^^ J2 E{x^^\j)y^^ {D^^\x^^) < e , (10) 
mB.xI{Xum;K^)<e . (11) 



An {n, Jn) code for the compound channel with quantum 
wiretapper {\Nt,Vt)te9 consists of a stochastic encoder E : 
{1, • • • ,Jn} — > P{A") and a collection of mutually disjoint 
sets {Dj C : j e {1, • • • , J„}} (decoding sets). 

A non-negative number R is an achievable secrecy rate for 
the compound channel with quantum wiretapper {\Nt,Vt)tee 
having CSI at the encoder, if for every positive e, 6, every 
t £ 9, and a sufficiently large n, there is an {n, J„) code 
iEt,{Dj : j = 1, • • • , Jn}) such that ^ log J„ > i? - 6, and 

max max V Etlx^'im" (D'^lx'') < e , (12) 
tee ie{i,-,J.} ^„ ^ 

maxx(X„™;Zf") <e . (13) 

Here are the resulting quantum states at the output of 
wiretap channels V". 

A non-negative number R is an achievable secrecy rate for 
the compound channel with quantum wiretapper (}Nt,^t)te9 
having no CSI at the encoder, if for every positive e, 5 and 
a sufficiently large n, there is an (n, J„) code [E, {Dj : j = 
1, • • • , Jn}) such that i log J„ > i? — 5, and 

max max V £;(a;"|i)W"(D"|a;") < e , (14) 
tee je{i,-.J„} k u) tK j\ > - 

maxx(X„„,;Zf") <e . (15) 

An (n, J„) code carrying classical information for the 
compound quantum wiretap channel {Wt:Vt)tee consists of 
a family of vectors w {wij) : j = I,-- - ,Jn} C 
iS(i/''^") and a collection of positive semi-definite operators 
{Dj : j e {1, • • • , Jn)} C S{H"'^"') which is a partition of 
the identity, i.e. X]/=i — idun»n. 

A non-negative number R is an achievable secrecy rate with 
classical input for the compound quantum wiretap channel 
{Wt,Vt)tee having CSI at the encoder with average error, 
if for every positive e, S, every t E 9, and a sufficiently 
large n, there is an (n, J„) code carrying classical information 



{wt := {wt{j) : j},{Dj ■ j}) such that ^log J„ > R~ S, 
and 

max ^ V tr (id^,,®. - " {wt{j)) Dj) < e , (16) 

J = l 

maxx(X„„,;Zf") <e . (17) 

A non-negative number R is an achievable secrecy rate with 
classical input for the compound quantum wiretap channel 
{Wt, Vt)tee having no CSI at the encoder, if for every positive 
e, S, and a sufficiently large n, there is an (n, J„) code carrying 
classical information (w :~ {w{j) : j},{Dj : j}) such that 
i log J,i > i? — 5, and 

max max tr - Wf" (w(j)) Dj) < e , (18) 

maxx(X„„,;Zf") <e . (19) 
tee 

Instead of " achievable secrecy rate with classical input for 
the compound quantum wiretap channel ", we say R is an 
achievable secrecy rate for the compound classical-quantum 
wiretap channel {Wt,Vt)tee- 

An (n, Jn) code carrying quantum information for the com- 
pound quantum channel (^t^")^^^ consists of a Hilbert spaces 
such that AmiH^ — Jn, and a general decoding quantum 
operation D, i.e. a completely positive, trace preserving map 
D : S{H^'") S{H'^), where is a Hilbert space 

such that dimiJ®^ = J„. The code can be used for the 
entanglement generating in the following way. The sender 
prepares a pure bipartite quantum state , defined on 

H'^(E)H'^ , and sends the portion of it through the channel 
Nf'". The receiver performs the general decoding quantum 
operation on the channel output D : S{H^") S{H'^^). 
The sender and the receiver share the resulting quantum state 

or := [zd« ^ {D o iVf ")] -P") . (20) 

A non-negative number R is an achievable entanglement 
generating rate for the compound quantum channel {Nf^)^^^ 
if for every positive e, 5, and and a sufficiently large n, there is 
an (n, J„) code carrying quantum information (-ff'^, D) such 
that i log Jn> R - S, and 

minF{nr\\^K){^Kf'^) >l-s, (21) 

where 

V '^n T 

which is the standard maximally entangled state shared by the 
sender and the receiver and {|:/)^'} are orthonormal 

bases for H'^ and H^, respectively. 

The largest achievable secrecy rate is called the secrecy 
capacity. The largest achievable entanglement generating rate 
is called the entanglement generating capacity 
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III. Classical Compound Wiretap Channels 



Let A, B, C, 9, and {\Nt,\/t)tee be defined as in Section 
im For every t e 6* fix a probability distribution pt on A". Let 

^0 , else 

and := ^i,^ be a family of 

random matrices whose entries are i.i.d. according to p'^, where 
Ln.t is a nature number, which will be specified later 
It was shown in IS) that for any > 0, if we set 

where ^ is a positive constant which does not depend on j, 
t, and can be arbitrarily small when w goes to 0, then there 
are such {Dj : j — 1, • • • ,Jn} that for all t e 6* and for all 

Ln.t e N 



Pr 



max / 

J6{lr-- J,^} ^ Ln,t 



(22) 



Since here only the error of the legitimate receiver is analyzed, 
for the result (l22t just the channels W^, but not those of the 
wiretapper, are regarded. Here for every j e {I,-- - ,Jn}, 
I e {I,-- - ,i„,t}, and t e 6, \N]^{D'^\x!j*J) is a random 
variable taking value in ]0, 1[, which depends on X^^^, since 
we defined xj*^ as a random variable with value in A". 

In view of ((l2|, by choosing Ln,t = [2"[^(p''^')+J1J , the 
authors of [8| showed that Cs,csi, the secrecy capacity of 
the compound wiretap channel with CSI at the transmitter is 
given by 

Cs,csi = mill max Bt) - I{U:, Kt)) , (23) 

tee u^A^(BK)t 

where Bt are the resulting random variables at the output of 
legal receiver channels. Kt are the resulting random variables 
at the output of wiretap channels. The maximum is taken over 
all random variables that satisfy the Markov chain relation- 
ships; U ^ A^ {BZ)t. 

Analogously, in case without CSI, the idea is similar to the 
case with CSI: Fix a probability distribution p on A". Let 



ifx«er;> 



^0 else 

and X" {^j;;}jG{i,--,./,>},ie{i:- :i,>}' where L„ is a 
natural number, which will be specified later, be a family of 
random matrices whose components are i.i.d. according to p'. 
For any cj > 0, define 

|^2"(miiitee(/(p;Wt)-i logL„-/i)j 



^71 



where /i is a positive constant which does not depend on j 
and t, and can be arbitrarily small when ui goes to 0, then 
there are such {Dj : j — 1, - ■ ■ , Jn} that for all t e 6* and for 
all L„ G N 



Pr 



max y -Lw;{D''\Xj i) > VT2-""/2 | 



In view of dH, by choosing L„ = [2"!'"^^* ■f(P';^')+TlJ , 
the authors of |8| showed that Cs, the secrecy capacity of the 
compound wiretap channel without CSI at the transmitter, is 
lower bounded as follows 

Cs> max iuYmI{U]Bt)-ma.y.I{U]Kt)) . (25) 
u-^A~f{BK)t tee tee 

IV. Compound Channels with Quantum Wiretapper 
Let A, B, H, 6, and {\Nt,Vt)tee be defined as in Section 

El 

Theorem 1: The secrecy capacity of the compound channel 
with quantum wiretapper {}Nt,^t)tee in the case with CSI at 
the transmitter Cs,csi is given by 

Cscs/ = min max (/(Z^; i?f)— limsup — y(W: ")) . 

tee u^A^{BZ)t n^oo n 

(26) 

Respectively, in the case without CSI, the secrecy capacity of 
the compound channel with quantum wiretapper {\Nt,Vt)tee 
Cs is lower bounded as follows 

Cs> max (minI(U;Bt) -inaiix{U;Zt)) , (27) 

u^A^(BZ)t tee t 

where Bt are the resulting random variables at the output 
of legal receiver channels, and Zt are the resulting random 
quantum states at the output of wiretap channels. 

Remark 2: We have only the multi-letter formulas ( |26] l 
and ( |27] l, since we don't have a single-letter formula even 
for a quantum channel which is neither compound nor has 
wiretappers. 

Proof: 1) Lower bound for case with CSI 

For every t G 9, fix a probability distribution pt on A". Let 

J = 1^2"'™'"'^^''"''-^''^*-'" " 

where L„ t is a natural number that will be specified below. 
Let pj, X^*\ and Dj be defined as in the classical case. Then 



still holds since the sender transmits through a classical 
channel to the legitimate receiver. 

Let 

gt(x") := np^v„av^nv,.4x")-vf"(x")-nv„.(x")np^v„av^ 

where a will be defined later 

Lemma 1 ( 4251/).- Let p be a quantum state and X be a 
positive operator with X < id and 1 — tr(pX) < A < L Then 



\\p-VXpVx\\ < V8A 



(28) 



In view of the fact that flp^y^^a^/a ^"d nvj,a(a;") are both 
projection matrices, by ([T), ([7), and Lemma [T] for any t and 
a;" it holds that 



||Qt(x")-vf"(x")|| < 



2{ad + d) 



(29) 



< \/T2""'^/2 



(24) 



We set 8f :— J^x^eT" p'^ {x"')Qt{x'^)- For given z" and 
t, (z"|9t|z") is the expected value of (z"|(5t(a;")|z") under 
the condition e 7^" ^. 
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Lemma 2 ( Let V be a finite dimensional Hilbert 
space. Let £ C SiV) be a collection of density operators such 
that a < fi- idi> for all a E £, and let p be a probability distri- 
bution on on £. For any positive A define a sequence of i.i.d. 
random variables Xi, - ■ ■ , taking values in £ such that 
for all a e £, we have p{a) = Pr |x, = W^j^ ■ a ■ H'p^x}' 

where p := J2ae£ P^'^'^'^' '^^'^ a '■^^ projector onto the 
subspace spanned by the eigenvectors of p whose correspond- 
ing eigenvalues are greater than ^jj^pjj- For any e e]0, 1[, the 
following inequity holds 



to 0. The equality in the last line holds since 

S{pt)-S{Vt\pt) 



xiPuZt) . 



21n2(dimV)At 



\ i=l 

< 2 • (dimV)exp ( -L 



(30) 



Let V be the range space of Hp^Vt.aVa- @ we have 
dimV < 2"'^(P')+^''"v^ _ 



Furthermore, for all x" 



^ r)~7i-S(Vt\pt)+Kada^ jj 

< 2-"-5'(Vtbt)+-ffadav^ . _ (-32-) 

The first inequality follows from (|6). The second inequality 
holds because IIvj.q and Hp^y^ are projection matrices. 
The third inequality holds because Hp^Vt as/a ^ projection 
matrix onto V. 

Let A = e, by applying Lemma |2] where we set p, 
enough we have 



^ 2n(5(pt) + -R'dQV*^^) 



(32) 

exD (^-i ,\ . 2"(5'(vt|pt)-s'(pt))+/f<iay?r(ys-i)\ 

" 21n2 7 

<2P'{S{'pt)^KdoL\/Q/a) 

. exp (^-L„,t^A • 2"(-x(p*;^*))+ifrf"v^(y^-i)^ 

< exp (-L„,t • 2-"(x(P*'^*)+^)) , (33) 

where ( is some suitable positive constant, which does not 
depend on j, t, and can be arbitrarily small when e is close 



Let Ln,t = |"2"(x(pt;2t)+2C)-|^ ^^^j „ j^^-gg enough, then 
by (l33]l for all j it holds that 



\ 1=1 



6*11 >e <exp(-2"«) (34) 



and 



\ * j 1=1 / 

> 1 -rj„exp(-2"^) 

> 1 — r2"'™'"'^'''"'^'^''^'^" " '°^^"''^exp(— 2"'') 



> 1 - 2" 



(35) 



where v is some positive suitable constant which does not 
depend on j and t. 

Remark 3: Since exp(— 2"^) converges to zero double ex- 
ponentially fast, the inequality (|35] | remains true even if T 
depends on n and is exponentially large over n, i.e., we can 
still achieve exponentially small error 

From (l22T l and (l35T l it follows: For any e > 0, if n is large 
enough then the event 



n| max y-^W^iD'; 



wi4/)<^ 



n 



^— Qt(4*/)-et|| <eViVj 



has a positive probability. This means that we can find a 
realization x^^j of Xj^^ with a positive probability such that 
for all t e 6* and j e {1, • • • , J„}, we have 



and 



6*11 <e . 



(36) 



(37) 



For an arbitrary 7 > let 



R := min max (I{U; BA - Zt)) - 7 

tee u^A^(BZ)t ^ ^ ' ' ' " 
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Choose /i < ^7, then for every t ^ 9, there is an {n, J„ ) code 

UxfJ)j^i^... j^j^i^... ^L„,tADj : j = ,Jn}) such that 



lim inf — log J„ > R 

n— >oo n 



(38) 



lim max max V W"(DJ|a;^*h = . (39) 



Choose a sufficiently a in ( |29l ) such that for all j, it holds 
Pn^fl)- Qtixfln < e . For any given f G {1, • • • , J„}, 
(lig and (O yield 



1=1 ;=i 



1 



<Ei^ii^?"(4m)-q*(4' 



(*) 



Et^q*(4'1/)-0* 



1 = 1 

< 2e , 



(40) 



and II E-Zi ± Ef=Y LriV?"(45) - 0*11 ^ ^- 

Lemma 3 (Fames inequality (cf. [28])): Let $ and be 
two quantum states in a d-dimensional complex Hilbert space 
and 11$ - *|| < Ai < then 



|S'(<I>) - S'(^')| < ^logd-/ilog^ 



(41) 



By Lemma [3] and the inequality (l40l ). for a uniformly 
distributed distributed random variable Xuni with value in 



{1, • • • , J„}, we have 



= 4Ef El^vn.g)) 

\j=i ■^^ 1=1 / 

-El^fET^vr(4:)) 



< 



1=1 

L, 



T Jn , ^ Ln.t 
v]=l 1=1 



^(eO-ET^(E7^^?"(4* 

j=i ^" \i=i 

< e log d — e log e 



J n 



5(e,)-5(E7^vr(xg) 



< 3e log d — e log e — 2e log 2e . 



(42) 



By (l42l l. for any positive A if rt is sufficiently large, we have 



max 

tee 



x(X„™;Zf")<A 



(43) 



For every t £ 6 we define an {n, J„) code {Et, {Dj : j = 
1, • • • , J„}), where Et is so build that Pr (^Et{j) = x^*;''^ = 
-J-!— for Z e {1, • • • , -Z^n,t}. Combining ( [39] l and (|43] | we obtain 



C^s,C5/ > min max (/(Z^; Bt) - x{U; Zt)) 
tee u^A^(BZ)t 

> min max (I(U; Bt) - lim sup ")) ■ 

(44) 



Thus, we have shown the ">" part of i 

2) Upper bound for case with CSI 

Let (C„) be a sequence of (n, Jn) code such that 



max max V E(x"\j)\Nl\D^Ax") 



maxx(J;Zr)=:e2,„ , 



(45) 



(46) 



where lim„^oo ei.n = and lim„^oo e2,n — 0, J denotes the 
random variable which is uniformly distributed on the message 

set {1, . . . , Jn}- 

Denote the security capacity of the wiretap channel (Wf , Vt) 
in the sense of E?) by C(Wi,Vt). Choose t' e 9 such that 
C(Wt,,VtO =minte,C(Wi,VO. 

It is known (cf. Il20ll ) that even in the case without wire- 
tapper (we have only one classical channel \Nt'), the capacity 
cannot exceed I{Xuni\ Bt') + £, for any constant ^ > 0. Thus 
for any e > choose ^ = ^e, then the capacity of a classical 
channel with quantum wiretapper (Wj/ , ) cannot be greater 



7 



than 



I{Xum;Bt-)+^ 

< [IiXum;Bt>) - limsup xiXum; Z^")] + e + £2,™ 

n— >-oo 

< [/(X„™; - limsup -xiXum; Zf^)] + e . 



for any uniformly distributed distributed random variable 
with value in {1, • • • , J„}. 



Combining 



and 



we obtain 



Cs> max [rain I [U \ Bt) — vii&yixiU-, Zt)) ■ 
u^A^(BZ)t tee tee 



Since we cannot exceed the secrecy capacity of the worst 
wiretap channel, we have 

Cs.csi < min max {liU; St)-limsup -xi^l; Zf")) . 
tee u^A^(BZ)t n^oo n ^ 

(47) 

Combining (|47] | and (l44l) we obtain ( |26] |. 

5j Lower bound for case without CSI 

Fix a probability distribution p on A" . Let 

where L„ is a nature number that will be defined below. Let 
p', X", and Dj be defined as in classical case, then (l24l i still 
holds. 

Define 

and :=Ex"er" 

Pi" 

Let L„ = p2""^'^'(x(P'^*)+'5)] and n be large enough, in 
the same way as our proof of (l35t for the case with CSI at 
the encoder, there is a positive constant v so that 

(iiE z:^*^^^' ^ " - ' ^^') - ^ " ■ 

(48) 



Choose a sufficiently a, by ( |24] | and ( |48] ) there is a realiza- 
tion Xj.; of ; with a positive probability such that: For aU 
t E 9 and all j G {1, • • • J„}, we have 



/=1 

For any 7 > let 

R := max min/(Z//; i?f) — max y(Z//; Zf) ) — 7 . 

Then there is an (n, J„) code {E,{Dj -.j = !,■■■ , J„}), 
where E is so build that Pr {E{j) — Xj^i) ~ -j-^ for 

Z e {1, • • ■ I -^n,t}, such that lim inf„_i.oo ^ log J„ > R, and 

lim max max V — W"m?|a:,- /)) = . (49) 
n^oo tee iG{i,-,./„}^ L„ jiJ'^^ 

In the same way as our proof of (|43) for the case with CSI at 
the encoder, 

maxx(X„„,;Zf")<e, (50) 

t^9 



V. Compound Classical-Quantum Wiretap 
Channel 

Let A, H, H\ H", 9, and {Wt,Vt)tee be defined as in 
Section M 

Theorem 2: The secrecy capacity of the compound 
classical-quantum wiretap channel in the case with CSI is 
given by 



csi= lim min max -(x(P„.p; i?f" )-x(Pmp; ")) 
n— foo tee Pinp,wt n 



(51) 

where Bt are the resulting random quantum states at the 
output of legal receiver channels and Zt are the resulting 
random quantum states at the output of wiretap channels. The 
supremum is taken over all probability distributions Pinp on 
the input quantum states wt- 

Assume the sender's encoding is restricted to transmitting 
an indexed finite set of orthogonal quantum states {p^ : x E 
A} C iS(i?''^"), then the secrecy capacity of the compound 
classical-quantum wiretap channel in the case with no CSI at 
the encoder is given by 



Cs 



lim max - f min y(ZY; Bf") 
n^ocu^A^{BZ)t n \ tee 



maxx{U;Zf^) 



te 



(52) 



Proof: At first, we are going to prove (ISTt . Our idea is to 
send the information in two parts. Firstly, we send the channel 
state information with finite blocks of finite bits with a code 
Ci to the receiver, and then, depending on t, we send the 
message with a code Cj*"* in the second part. 

1.1) Sending channel state information with finite bits 

For the first part we don't require that the first part should 
be secure against the wiretapper, since we assume that the 
wiretapper already has the full knowledge of the CSI. 

By ignoring the security against the wiretapper, we can 
consider only the compound channel (Wt)tee- Let W = {Wt)t 
be an arbitrary compound classical quantum channel. Then by 
[5 1 for each A e (0, 1) the A-capacity C{W, A) equals 

C{W,X)^ max min x{P^np■, Wt) . (53) 

If maxp;^ miuf x{Pinp\ Wt) > Q holds, then the sender can 
build a code Ci such that the CSI can be sent to the legal 
receiver with a block with length I < —. . „ frr-r — 

— mint ma-Kp.^^ x(Pinp,Wt) 

e. If maxp;^ min^ x{Pinp] Wt) — holds, we can not build 
a code Ci such that the CSI can be sent to the legal receiver 
But this does not cause any problem for our proof, since if 
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maxp;^p mint x{Pinp\ Wt) = the right hand side of (ISTT i is 
zero. This means in this case we need to do nothing. 

1.2} Message transformation when both the sender and the 
legal receiver know CSI 

If both the sender and the legal receiver have the full 
knowledge of t, then we only have to look at the single wiretap 
channel iWt,Vt). 

In IIT2I and 1T31 it was shown that if n is sufficiently large, 
there exists an {n, J„) code for the quantum wiretap channel 
(W, V) with 

log J„ = max (x(P»„p; -B«") - x{P^np; ^^")) - e , (54) 

for any positive e and positive S, where B is the resulting 
random variable at the output of legal receiver's channel and 
Z the output of the wiretap channel. 

When the sender and the legal receiver both know t, they 
can build an (n, J„.t) code Cj*^ where 

log Jn.t = max {x{P,np; Bf^) - x{P^np\ Zf^)) - 6 . (55) 

Pinp, Wt 

Thus, 



Ccsi> lim min max -(x(P»p; Sf ")-x(Pmp; ")) . 

n->-oo tee Pinp,wt n 



Remark 4: For the construction of the second part of our 
code, we use random coding and request that the randomiza- 
tion can be sent (cf. [12]). However, it was shown in [81 that 
the randomization could not always be sent if we require that 
we use one unique code which is secure against the wiretapper 
and suitable for every channel state, i.e., it does not depend on 
t. This is not a counterexample to our results above, neither to 
the construction of Ci nor to the construction of Cg*^ because 
of the following facts. 

The first part of our code does not need to be 
secure. For our second part, the legal transmitters 
can use the following strategy: At first they build a 
code Ci = iE,{Dt : t = l,---,!^!}) and a code 



C!f> = {EW^{Df' : j 1,... , J„}) for every t e 6. If 
the sender wants to send the CSI t' G and the message j, 
he encodes t' with E and j with i?'* then he sends both 
parts together through the channel. After receiving both parts, 
the legal receiver decodes the first part with {Dt : t}, and 
chooses the right decoders {of^ : j} e ^ : j} : t e 9^ 

to decode the second part. With this strategy, we can avoid 
using one unique code which is suitable for every channel 
state. 



1.3) Upper bound for the case CSI at the encoder 

For any e > choose f e such that C{Wt',Vt') < 

inUeeCiWt,Vt) + e. 

From (T2\ and fT3l we know that the secrecy capacity of 

the quantum wiretap channel {Wt' , Vt> ) cannot be greater than 

lim max i{x{P^np; Bf") - xi^np; Zf")) . 

n-^oo Pi„„,to,, n 



Since we cannot exceed the capacity of the worst wiretap 
channel, we have 

Ccsi< lim min max - {x{P^np; Bf") - x{Pnp; Zf")) . 
n— >oo tee Pi„p,wt n 

(57) 

This together with (l56T l completes the proof of (ISTT i. 

Remark 5: In Ii26i it was shown that if for a given t and 

any n E N 

x(P»p;i3f")>x(^'mp;^r) 

holds for all Pinp G P{A) and {wt{j) : j = 1, • • • , J„} C 
then 

lim max -{xiP.np; Bf^) - xiP^np; Zf^)) 

n— i-oo Pinp.wt n 

= max (x{Pinp;Bt) - x{Pinp] Zt)) ■ 

Pinp.Wt 

Thus if for every t E 6 and rt e N, 

I{Pinp, Bf^^) > I{Pinp;Zf^) 

holds for all Pinp e P{A) and {wt{j) : j = 1, • • • , J„} C 
S{H®'^), we have 

Ccsi = min max {x{Pinp;Bt) - xiPinp', Zt)) . 

tee Pinp,wt 



(56) Now we are going to prove (|52] l. 



2.1) Lower bound for case without CSI 
Fix a probability distribution p on A". Let 



and let p' and X" = {Xj,i : j, 1} be defined as in the clas- 
sical case (cf. SectionHIB. Since J„-L„ < 2™"' xCp^s?")-"^', 
in ifTTI . it was shown that if n is sufficiently large, there exist 
a collection of quantum states {px^ ■ a;" G A"} C S{H'^"), 
a collection of positive semi-definite operators {Dt,x" '■ t E 
6,x" E A^}, and a positive constant /3, such that for any 
{tj,l) e 6* X {!,• •• , J„} X {1, - •• ,L„} it holds 



Pr 



tr {wnp%l)Dt,x,^,) 



> 1 



l-n/3 



> 1-2 



-n,3 



(58) 



and for any realization {xjj : j, 1} of {Xjj : j, 1} it holds that 

< id . 



Jr. L„ 



tee j=i 1=1 



Define 



and :=E."gr" 

Choosing n sufficiently large, in the same way as our proof 
of (1351 ) for the classical compound channel with quantum 
wiretapper, there is a positive constant v such that 

(59) 
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where lini„_j.oo A„ 



Choosing a sufficiently a. If n is sufficiently large, we can 
find a realization Xjj of Xjj with a positive probability such 
that: For all j e {1, • • • J„}, we have 



mm tr 

tee 



> 1 - 2-"'^ 



and 



tee "-^ — ' L„ 

1=1 



Define := Etee then Y^fU^j 

J2tee Ei=i Ef=i Dt,x,,, < irf- Furthermore, for all t' e 
and r G {1, • • • , L„} we have 

tee ;=i 
>tr (w^,?(p^",,)A'..,,,) 



> 1 



the inequality in the third line holds because for two pos- 
itive semi-definite matrices Mi and A/2, we always have 
tr (M1M2) = tr (vl/iAfaV^) > 0. 
For any 7 > let 
1 



R max — 

U^A^(BZ)t n 



minx(p;Sr)-maxx(p;^r) 



-1 



Then for any positive A, there is an (n, J„, A) code 

"LtiTZPtZ ■■ J = h-'-^JuAADj : J = l,---,Jn}], 
such that lim inf „_j.oo ^ log Jn > 

max max tr (id„„e„^ - VFf " (w(j)) D,) < A , (60) 
tee je{i,-.J„} ^ ~ 

and in the same way as our proof of (|43] l for the classical 
compound channel with quantum wiretapper. 



maxx(X„™;^r) < A 

t^9 



(61) 



for any uniformly distributed random variable Xuni with value 
in {I,-- - ,J„}. 

Combining (I6OI 1 and (I6TI 1 we obtain 



Cs> lim max - f min y(Z^; ") 

n-)-ooW-i-A-j-(BZ)t n \t66l 



and lim„_j.oo ^2,n — 0, X^ni denotes 
the random variable which is uniformly distributed on the 
message set {1, . . . , J„}. 

Denote the classical capacity of the quantum channel Wt in 
the sense of ||27] by C{Wt). Choose t' e such that C{Wt') = 
minteeCiWt). 

It is known (cf. |20|) that C{Wt') cannot exceed 
x{Xuni', Bfl"^) + ^ for any constant ^ > 0. Since the secrecy 
capacity of a compound wiretap channel cannot exceed the 
capacity of the worst channel without wiretapper, for any e > 
choose ^ = ie, if n is large enough the secrecy rate of (C„) 
cannot be greater than 

-X(^nn.;Br)+e 

n 

= minix(^n™;Sf")+C 
tee n 

< min -xiXum-, Bf"') - max -x{Xum;Zf^) + ^ + -e^^n 
tee n ted n n 

< - (mmx{Xum;Bf") - maxx(X„„,; Zf ")) + e . 
n \ tee ' 



tee 



(65) 



Thus 



Cs < lim max -(mmx{U; Bf") - max x(W; Zf ") 
n^<^w^A^(BZ)t n \ tee tee ' ' 

(66) 

Combining ( |66] | and {6% we obtain ( |52] |. ■ 



maxx(Z^;2r) 
(62) 



2.2) Upper bound for case without CSI 

Let (C„) = ({Pj"'' : i}>{^j"'' : j}) be a sequence of 
(n, Jn, A„) code such that 



max 
tee je 



max^ ^ tr (id - " (pj"^) I?}"^ ) < A„ , (63) 



maxx(^um; ^t^") =: £2,™ 



(64) 



So far, we assumed that \6\, the number of the channels, 
is finite, therefore we can send the CSI with finite bits to the 
receiver in the case having CSI at the encoder Now we look 
at the case where \6\ can be arbitrary. We of course are not 
allowed to send the CSI with finite bits if \6\ = 00, but in this 
case, we may use a "finite approximation" to obtain 

Corollary 1: For an arbitrary set 6 we have 

Cs,csi= lim inf max -{x{P^np■, Bf^)-x{P^up■, Zf'^)) . 
n^oo tee Pi„p,wt n 

(67) 

Proof: Let W : S{H') S{H") be a Hnear map, then 

let 

||VF||o:=sup max \\{idn ® W){a)\\i (68) 

neN aeS(C"^H'),\\a\\i = l 

where || • ||i stands for the trace norm. 

It is known II2TI that this norm is multiplicative, i.e. HVl^® 

W^'llo = l|W^llo-||W^'llo- 
.A T-net in the space of the completely positive trace 

preserving maps S{H') — > S{H") is a finite set (W^*-'^-') of 
completely positive trace preserving maps S{H') — > S{H") 
with the property that for each completely positive trace 
preserving map W : S{H') S{H"), there is at least one 
k e {!,■■■ ,K} with WW-W^'^mc < T. 

Lemma 4 (r-net jfTPl/ ).- Let H' and be finite- 

dimensional complex Hilbert spaces. For any r e (0, 1] there 
is a r-net of quantum-channels (W^'"'^'') in the space of the 
completely positive trace preserving maps S{H') — >■ S{H") 
with K < (f where d' = dimi?'. 
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If 16*1 is arbiti-ai-y, then for any ^ > let t = _ ^ . By 

Lemma m there exists a finite set 6' with \9'\ < (f)^'' and 
r-nets {Wt')^,^g,, {Vt')^,^^, such that for every t G 9 we can 
find at' e0' with \\Wt - WfW^^ < r and \\Vt - Vf'||^ < r. 

For every t' £ 6' the legal transmitters build a code Cj* ^ = 
{wt' T{Dti .j : j}}. Since by fT2l|, the error probability of the 
code C2 decreases exponentially to its length, there is an 

N 



0{- log^) such that for all t" e 6' it holds 

Jjv 



^5:tr(M^rK"(j))A"„ 



(69) 



(70) 



Then, if the sender obtains the channel state information 
'T' , he chooses a "t"' e 9' such that - WfW^^ < t and 
||Vt — Vf / II A < T. He can send "<"' to the legal receiver in the 



that 



first part with finite bits, and then they build a code C2 
fulfills i6% and (iTOl i to transmit the message. 

For every t' and j let IV't' (j)) (V'f (j)l G 
be an arbitrary purification of the quantum state 



Wt'ij), 



then 



tr [{W^ 



We have 

tr[{wr 



0N 



im'ij))] 



wr)i\^Aj)){^Aj)\)]) 

= tr «" - W^,?^) (|^t'(j)>(^*'(j)l)] 



< d'd"N^\\W^ 

< d'd"N^T , 
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mAj)){i^Ajmi 



where d" = dimiJ". The second equality follows from 
the definition of trace. The first inequality follows from 
the fact that for any matrix {aij)i=i^... ^n,j=i,--- ,71 it holds. 



— J2j — ISj^'il = |ti'(aij)i J- 1. The second inequal- 
ity follows by the definition of || • ||o. The third inequal- 
ity follows from the facts that || (IV"*' (j)) (V'f 0)1) II 1 — 



1 and \\Wf^- 

llWi-^'llo. si 
It follows that 

Jn 



{Wt - Wf 
is multiplicative. 



N 







^^tr«^K'0-))A'.,) 



Jn . , 

Jn 
J = l 



1 



tr(iy,?^ K'(j))A' 



1 



Jn 



1 



Jn 



< -^JNd'd"N^T 
Jn 



K,(j))A',j] 
K'(j))]| 



d'd"N^T 



(71) 



d'd!' N^T can be arbitrarily small when ^ is close to zero, 
since N = O(-log^). 

Let Xuni be a random variable uniformly distributed on 
{1, • • • , Jn}, and {p[j) : j — 1, - ■ ■ , J„} be a set of quantum 
states labeled by elements of {1, • • • , Jn}. We have 



\x{Xum:Vt) ^ x{Xum;VA\ 



Jn 1 

< 2r log d ~ 2t log r , 



3= 



(72) 



where d = dimiJ. The inequality in the last line holds by 
Lemma|3]and because ||Vf (p) — Vi'(p)|| < r for all p E S{H) 
when ||Vf — Vf'||^ < r. 

By (ITT) and we have 

Jn 



sup 
tee ^AT 



K.(j))A'j) > i~A-e-rf'rf"A^' 



^) < ^ + 2t log rf - 2t log T . 



Since (^ + d' d" N^t and 2rlogd can be arbitrarily small, when 
^ is close to zero, we have 



1 



Jn 



sup-^5]tr(M/f^KKj))A'.,) 
tee JAf 



> 1- A , 



supx(^. 
tee 



7 



The bits that the sender uses to transform the CSI is large 
but constant, so it is still negligible compared to the second 
part. We obtain 

Ccsi> lim inf max - (xi^np; Bf") - x{P^np■, Zf")) . 

n-^oo te9 Pir,p,wt n 

(73) 

The proof of the converse is similar to those given in the 
proof of Theorem |2] where we consider a worst t'. ■ 

Remark 6: In ( BTI ) and Corollary [T] we have only required 
that legal receiver can decode the correct message with a high 
probability if n is sufficiently large. We have not specified how 
fast the error probability tends to zero when the code length 
goes to infinity. If we analyze the relation between the error 
probability e and the code length, then we have the following 
facts. 

In the case of finite 6, let ei denote the error probability 
of the first part of the code (i.e. the legal receiver does not 
decode the correct CSI), and let £2 denote the error probability 
of the second part of the code (i.e. the legal receiver decodes 
the correct CSI, but does not decode the message). Since the 
length of first part of the code is I ■ log c ■ c' = O(logei), we 
have e^^ is 0(exp(Z • log c • c')) = 0(exp(n)), where n stands 
for the length of the first part of the code. And for the second 
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part of the code, £2 decreased exponentially to the length of 
the second part, as proven in |12|. Thus, the error probability 
e — max{ei,e2} decreases exponentially to the code length 
in the case of finite 0. 

If 6 is infinite, let £1 denote the error probability of the first 
part of the code probability. Here we have to build two r-nets 
for a suitable t, each contains 0((^i2££i )-2<i' ■) channels. If 
we want to send the CSI of these r-nets, the length of first 
part Z will be 0(— 2(i'"' •log(£i log£i)), which means here £j^^ 
will be 0(exp(^^)) = 0(exp(n)). Thus we can still achieve 
that the error probability decreases exponentially to the code 
length in case of infinite 9. 

VI. Entanglement Generation over compound 

QUANTUM CHANNELS 

Let fp, Q, iJ'P, H^, 9, and (^f")^^^ be defined as in 
section HI] (i.e. we assume 9 to be finite). 

Denote dimiJ'^ by a, denote X {1, • ■ ■ jO-}- Consider 
the eigen-decomposition of into the orthonormal pure 
quantum state ensemble {p{x), \4>x)'^ '■ x e X}, 

The distribution p defines a random variable X. 

Theorem 3: The entanglement generating capacity of 
{Nt)f^g is bounded as follows 



A > max minx(p; Qt) - maxx(p; Et) 
P y teo teB 



(74) 



where Qt stands for the quantum outputs that the receiver 
observes at channel state t, and Et the quantum outputs at the 
environment. 

(Theorem |3] is weaker than the result in [7 |, the reason 
is that we use for our proof a different quantum channel 
representation. For details and the result in [7| cf. Section 

rviii i 

Proof: Let — UNtP^U'^^ be an unitary transforma- 
tion which represents Nt (cf. Section IVIII i. where is a 
linear operator S{H^) — > S{H^'^), and 2; is the quantum 
system of the environment. Fix a with eigen-decomposition 

channel state is t, the local 
output density matrix seen by the receiver is 

and the local output density matrix seen by the environment 
(which we interpret as the wiretapper) is 

tro (^p{x)UNA(l^.){q^x\'^U*^}j . 

Therefore (Nt)t^g define a compound classical-quantum wire- 
tap channel (W^/Vt, V/Vt)tee> where ■ H'^ H^, 

and Vn, : H'^ ^ H^, E:,exPi^M-)i^-\'^ ^ 



] ) Building the encoder and the first part of the decoding 
operator 
Let 



J„ — |"2"["i™t x(^;Qt)-maxt x(-f ;-Et)-2i5]-| 



and 



n(maxt x{X\Et)+S) 



1 ■ 



For the compound classical-quantum wiretap channel 

{WNt,VNt)t<^0, since 

— J ■ T < 9"n"nt[x(-f ;Qt)-'5] 

if n is large enough, by Theorem |2] and fTT), the following 
holds. There is a collection of quantum states {p'^- , : j = 
1, • • • , J„, Z = 1, • • • , L„} c a collection of positive 

semi-definite operators {Dt.jj :— Dt.x^i : t € 9,j = 
1, • • • ,Jn,l — 1, • • • ,Ln}, a positive constant /3, and a 
quantum state on H'^ , such that 

r ((i?^;^ td'^^WN.pZ Uk) > 1 - 2-"^ , (75) 

ikS-?riii<^, (76) 

where uft := Ylf::^ trQ„ (t/jv^pf C^w* 

Now the quantum state p'^, ^ may be pure or mixed. Assume 

Pf-l is a mixed quantum state P". 
then 

n 

^ p',-, (^)tr (( ® ) t/iv. k« , ) , r " 



tr 



and 



> 1 - 2""*^ . 

Thus, for all i such that p'j^i{i) > 1^2-^1^ must hold 

If rt is large enough, then there is at least one ii^j E {1, • • • ,n} 
such that p'j > j^^^r^- By Theorem |2] there is a ^f" 

on H'^" , such that 



i-'n,t 

Thus, 



is a code with the same security rate as 

Hence we may assume that is a pure quantum state. 

Assume p'^,^ — \xj_i){xj,i\'^ . Let H^^ be a J„- 
dimensional Hilbert space with an orthonormal basis : 
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j = 1, • • • ,Jn}, be a L„-dimensional Hilbert space with 
an orthonormal basis {1^'*' : I = I,-'' jin,*}. and be 
a I I -dimensional Hilbert Space with an orthonormal basis 
{\ty : t e e}. Let |0)™|0)^|0)^ be the ancillas on H^, 
H^, and H^, respectively, that the receiver adds. We can (cf. 
©I) define a unitary matrix l/Q'^^Jifie ^Q"OT£e ^^^jj ^^at 
for any given quantum state e S{H^ ) we have 



and 



\"3,k) 



For every j £ {1, • • • , J„}, by ( iTST i it holds 



1 



fc=l 



1*^1 t=i ;=i 



t j I 

Denote 



Vj,i.t 



> 1 - e 



(79) 



V 



in view of (iTST l. we have 
> 1 - e . 



(77) 



By Uhlmann's theorem (cf. e.g. Il27l ) we can find a 

\Cj,i.t)^"'^" on iya"^", such that 



Hence there is at least one kj G {1, • • • , L^} such that for 
every j, we have 

1-e 

= ^E^"■^^(«.^^>.-..*)''"'"'^ 

for a suitable phase Sfc . Since for all t it holds 



< 1, we have 



mm 

tee 



>l-|e|e 



-^\Vj,i,t AQ3,i,t){Qj,i,t\ 



®\j){jf'®\l){l\~®\t){t\' 
> 1 - e . 



2) Building the seconder part of the decoding operator 
Define 



(78) 



Therefore, there is a suitable phase r^^ such that for all t £ 9, 

l-\6\e 



< 



E' 

\i=i 



ms,e 



(80) 



and 



1. 



For every j', and t, we have (aj_;|6j.;^t)'P"^'*'^ > 1 — £■ 
Define 



\;=i 

For every t E 9, we set 

L 



and 



1^. 



1=1 

L„ 



-L \ ' 2ml p- 



(c/ri>^,,/)'p")io)^io)^io)^ 



For all i e 6* and j e {1, • • • J„} it holds by dSOll 
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that if we set 



|n7j,t)(n7,,tr'^"^®b-)(jr®|t)(tr 



id"" 



1 



then 



> 1 - 4e - 4\/i , 
„ _ (85) 

where is chosen so such that is a 

purification of on iJ^ ^. 

5j Defining the code 

We can now define our entanglement generating code. Let 
t' be arbitrary in 9. The sender prepares the quantum state 
Furthermore, since (|76) holds there is a quantum state , 



>i-\e\e 



which does not depend on j ant on H'^ such that 



1 1 



< e ■ (82) 



EE 



By monotonicity of fidelity, for any ^ e {1, • • • , L„} 



V J=l 1=1 



(86) 



keeps the system 21 and sends the system *P" through the 



channel Nf"^, i.e., the resulting quantum state is 



1 F( ,/,£J"<£'*OT£e \r Mr 



< 2 

< 2v^ , (83) 

the first inequality holds because for two quantum states g and 
77, we have ^Hfi* — ?7||i < ^1 - F{q, t])'^. 
By ^ and ((831) 



1 1 



J-n Lrr 



1 1 



Ei^-)'' E^""^O.v)'"" 
j=i \i=i 



" 1=1 



EfEe^'^^'i^Kzr(c/tr)oi" 

3 = 1 \l=l I 



The receiver subsequently applies the decoding operator 



+ 



Nt 



(r*^" |0)(0|^® |0)(0|^® |0)(0|") 



< 2Vi + e , 



(84) 



(87) 



holds for alltee and j G {1, • • • , J„}. his outcome. 

In 1231 (cf. also ||T3l) it was shown that when holds, 3.1) The resulting quantum state after perfonning the decoding 
for every t £ 9 we can find a unitary operator U^-^ such operator 
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Define 



1 



1 1 

Jn 



i=i 

>l-|0|e. 



(89) 



5.5; r/ze fidelity of ^ E/^i X,^;''"^'= ® |j)Or ® ItOi^T 
fl«t/ the standard maximally entanglement state 
By dSST l we have 



Vtee 

|(Eb7^i^.*'>^"""^"'^)(E(^..'i^"^'"^"''or) 



^ E ® b-)of ® \j){jr ® \t'){t'\' 

> 1 - 4e - 4Ve . 



(90) 



\tee / 



(88) 



5.4j The fidelity of the actual quantum state and the standard 
maximally entanglement state 

Since for two quantum states g and 77, it holds 

1, 



then the resulting quantum state after performing the decoding 
operator is trQ.e.£9(t2;a"e"^'ftsf )^ 

3.2) The fidelity of ^ xf^''"'^'' ® ® \t'){t'\' 

and the actual quantum state 
Because 



for three quantum states g, rj, and v, we have 

F{g,v) 

>i-l\\g-ri\h 

> l-^ll£'-^lli-^ll^'-^lli 



> 1 - v/1 - F{g, v)^ - - Fiv, T^Y . 
Combining (|89ll and (|90]l, for all t' e 9 we have 

F I trQ>^er.£0(^,: 



),Ei^')oi''®i^')oi'" 



Vtee / 
tee 

Etee ® is unitary. 

Because of this unitarity and by dSTT l 



®b-)01''^|j)01'^®IO(i'l 



^ff(Eb-)"l'?..' 



(91) 
(92) 



i=i 



This means that if n is large enough, then for any positive 
6 and e, there is an (n, y/2\6\y/e + ^/S-^) code with rate 
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{Nt)t^a with CSI at the encoder is 



Proposition 1: The entanglement generating capacity of 

tee 

1 

n-i-oo n tee pes{H)^" 



A. 



CSI 



lim — min max Ic{p\Nt^^) 



(93) 



Proof: As being shown in [111, after receiving a dummy 
code word as the first block, the sender also can have the CSI. 
Then we have the case where both the sender and the receiver 
has the CSI. But this case is just equivalent to the case when 
we only have one channel {Nt), instead of a family of channels 
{{Nt) : i = 1, • • • , and we may assume it is the worst 
channel. The bits that we use to detect the CSI is large but 
constant, so it is negligible compared to the rest. By [13] the 
entanglement generating capacity of the quantum channel Nt 
is 



lim — 

n-*oo n peS(H)^ 



max /c(p;iVf") 



The proof of the converse is similar to those given in the 
proof of Theorem |2] where we consider a worst t'. ■ 

Proposition 2: The entanglement generating capacity of 
(iVt)jgg with feedback is bounded as follows 



1 



A feed > lim — mm max 
ji-i-cx) n tee pes(H)'^ 



(94) 



Proof: As we shown in Section IV, the receiver can detect 
the channel state t correctly after receiving a dummy word as 
the first block. Then he can send t back to the sender via 
feedback. ■ 
Remark 7: For a one-way entanglement distillation protocol 
using secret key, see (14]. For arbitrarily varying classical- 
quantum wiretap channel, which is a generalization of com- 
pound classical-quantum wiretap channels, see ifTOl . 

VII. Further Notes 

Let q3, 0, iJ'P, and be defined as in Section |ll] Let N 
be a quantum channel — > S{H^). In general, there are 
two ways to represent a quantum channel, i. e. a completely 
positive trace preserving map S{H'^) S{H^), with linear 
algebraic tools. 

1. Operator Sum Decomposition (Kraus Representation) 



K 

1=1 



(95) 



where Ai,--- ,Ak (Kraus operators) are linear operators 
S{H'^) S{H^) (cf.[17J, [3J, and \2Qi). They satisfy the 
completeness relation X^ili = idj^fs . The representa- 

tion of a quantum channel N according ( |95l l is not unique. Let 
Ai, - ■ ■ , Ak and i?i , • • • , Bk' be two sets of Kraus operators 
(by appending zero operators to the shorter list of operation 
elements we may ensure that K' ^ K). Suppose Ai, - ■ ■ , Ak 
represents N, then i?i , • • • , Bk also represents N if and only 
if there exist a K x K unitary matrix {uij)^^^-^ ^ such 
that for all i we have Ai — J2f=i ^i.j^j ('-f- [20]). 
2. Isometric Extension (Stinespring Dilation) 

N{p) = tre (UnpU*^) , (96) 



where C/at is a Hnear operator 5(iJ'P) S{H^'^) such 
that U^Un = idfjv, and £ is the quantum system of the 
environment (cf. Il24l . [|3| , and also [25] for a more general 
Stinespring Dilation Theorem). H'^ can be chosen such that 
dimH'^ < {dimH'^)^. The isometric extension of a quantum 
channel N according ( |96] l is neither unique. Let U and U' 
be two linear operators S{H'^) — > S{H^'^). Suppose U 
represents N, then U' also represents N if and only if U 
and [/' are unitarily equivalent. 

We can reduce each of these two representations of quan- 
tum channel from the other one. Let Ai, - ■ ■ , Ak be a 
set of Kraus operators which represents N. Let : 
j = I, - ' jK} be an orthonormal system on H'^, Then 
Un ~ X^jLi ® Ij)'^ is an isometric extension which repre- 
sents N, since (^f^, A, ® p (Ef=i ® |A:)«)* = 

Ef=iA,pA/ and (Ef=i^.®lj>")* {i:tiAu®\kr) 
= Ylif=iAj*Aj. On the other way round, every isomet- 
ric extension Um that represents N can be write in form 
Un = J2f=iAj <8) i.e. if the sender sends p, and 

if the environment's measurement gives the receiver's 
outcome will be AipA* . Here Ai, - ■ ■ , Ak is a set of Kraus 
operators which represents N, and : j — 1, • • • , K} is 

an orthonormal system on H'^. 

Using either of both methods to represent a quantum chan- 
nel, one can show that (cf. ^ and U3\) the entanglement 
generating capacity of a quantum channel N is 



A(N)^ lim - max Ic{p] N'^'') ■ (97) 
»i-i-oo n pes{H)°'^ 

The advantage of the Kraus representation is that it de- 
scribes the dynamics of the principal system without having 
to explicitly consider properties of the environment, whose 
dynamics are often unimportant. All that we need to know is 
the system of the receiver alone, this simplifies calculations. 
In II16I an explicit construction of a quantum error correction 
code (both perfect and approximate information recovery) with 
the Kraus operators is given. The main disadvantage of the 
Kraus representation is that the set of Kraus operators is not 
unique. The reason is that the choice of orthonormal system 



{\jY 



1, • • • ,K} is not unique, and it is much more 



difficult to check if two sets of Kraus operators represent 
the same quantum channel than to check if two isometric 
extensions represent the same quantum channel. 

In the Stinespring dilation, we have a natural interpretation 
of the system of the environment. From the Stinespring 
dilation, we can conclude that the receiver can detect almost all 
quantum information if and only if the channel releases almost 
no information to the environment. In [23] an alternative way 
to build a quantum error correction code (both perfect and 
approximate information recovery) using this fact is given. The 
disadvantage is that we suppose it is suboptimal for calculating 
the entanglement generating capacity of a compound quantum 
channel without CSI at the encoder 

In fl] the entanglement generating capacity for compound 
quantum channel is determined, using a quantum error cor- 
rection code of [[161 . which is built by Kraus operators. Their 
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result is the following. The entanglement generating capacity 
of a quantum wiretap channel N = {Nt)ff^g is 

A(N) ^ Mm - max min Ic ( p; Nt'^") . (98) 
rn-oo n peS{H)^" tee 

This result is stronger than our result in Theorem |3] This 
is due to the fact that we use for our proof a quantum 
error correction code of [551, which is based upon the Stine- 
spring dilation. If we use the Kraus operators to represent 
a compound quantum channel, we have a bipartite system, 
and for calculating the entanglement generating capacity of a 
compound quantum channel, we can use the technique which 
is similar to the case of a single quantum channel. However, 
if we use the Stinespring dilation to represent a compound 
quantum channel, we have a tripartite system, which includes 
the sender, the receiver, and in addition the environment. 
Unlike in the case of a single quantum channel, for compound 
quantum channel we have to deal with uncertainty at the 
environment. If the sender knows the CSl, the transmitters 
can build an (n, e) code for entanglement generating with 
rate mint [x(^; Qt) - xi^', Et)] -S ^ mintee Ic{p; Nt) - S 
(Proposition [U for any positive S and e. This result is optimal 
(cf. |7|). But if the sender does not know the CSI, he has 
to build an encoding operator by considering every possible 
channel state for the environment. Therefore the maximal rate 
what we can achieve is mint xi-^i Qt) — maxt Et), but 
not mintge /c(p; Nt) = mint [x{X; Qt) - xi^; Et)]- This is 
only a lower bound of the entanglement generating capacity. 
It is unknown if we can achieve the stronger result (|9Ft using 
Stinespring dilation. 
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